@bongos/core 1.19.364 → 1.19.365

package/modules/government/board.js

@@ -214,10 +214,13 @@ function validateVote({ direction, reasonMd, sectionKey } = {}) {
 
 // Cast a vote on an open item. Returns a typed result, never throws for a
 // policy refusal — the route maps each to its status:
-//   { ok: true,  vote, fresh: true, karma_delta }   — recorded now
-//   { ok: true,  vote, fresh: false }               — idempotent re-cast
+//   { ok: true,  vote, fresh: true, karma_delta, self_cast }  — recorded now
+//   { ok: true,  vote, fresh: false, self_cast }               — idempotent re-cast
 //   { ok: false, reason: 'item_not_found' | 'item_closed' | 'vote_window_expired'
-//               | 'not_board_member' | 'anti_self_vote' | <validateVote reason> }
+//               | 'not_board_member' | <validateVote reason> }
+// 'anti_self_vote' is GONE as of task 1003273 — an author may cast; what they
+// cannot do is decide alone, which shouldCloseAfterVote and tallyOutcome enforce.
+// A self-cast is recorded and visible but earns no karma (karma_delta: 0).
 async function castVote({ itemId, voterId, direction, reasonMd = null, sectionKey = null } = {}) {
   const id = Number(itemId);
   if (!Number.isFinite(id) || id <= 0) return { ok: false, reason: 'item_not_found' };
@@ -237,20 +240,34 @@ async function castVote({ itemId, voterId, direction, reasonMd = null, sectionKe
   const constitution = item.constitution || {};
   if (!(await isBoardMember(voterId, constitution))) return { ok: false, reason: 'not_board_member' };
 
-  // ANTI-SELF IS A FULL-IDEA RULE, NOT AN AMENDMENT RULE (R14, ADR 0175 §§7/11).
-  // The bright line exists because an idea's author GAINS from ratification
-  // (credits, legitimacy) — ceremonial self-ratification is what it prevents.
-  // An amendment pays nothing, and §7 explicitly blesses the monarchy act:
-  // under a one-Archon board with no clock, the proposer must be able to
-  // ratify their own amendment or the subject is dead on arrival — and adding
-  // a special escape for that case is the bootstrap exception §7 forbids.
-  // Skipping anti-self FOR AMENDMENTS is the rule that needs no exceptions.
-  if (item.subject_type === 'full_idea') {
-    const authorId = await db.getBoardItemAuthor(item);
-    if (authorId != null && String(authorId) === String(voterId)) {
-      return { ok: false, reason: 'anti_self_vote' };
-    }
-  }
+  // THE AUTHOR MAY NOW VOTE (task 1003273, owner decision 2026-08-25). The old
+  // rule refused an author's cast outright, which is defensible on a board of
+  // strangers and dead-ended here: every open item was authored by the one member
+  // reading them, so the room offered nine sittings and no ballot.
+  //
+  // WHAT REPLACES IT IS NOT A WEAKER RULE, IT IS A RULE IN A DIFFERENT PLACE.
+  // "An author never decides alone" is enforced where deciding actually happens —
+  // shouldCloseAfterVote (an author's cast never ends the sitting) and
+  // tallyOutcome (a majority with no non-author yes cannot carry, and an author's
+  // 'no' cannot return their own idea). Refusing the CAST was only ever a proxy
+  // for those, and it was the proxy that produced the deadlock.
+  //
+  // So there is no anti-self branch here any more, for either subject type. The
+  // amendment carve-out ADR 0175 §§7/11 blessed is subsumed rather than removed:
+  // a sole Archon proposing an amendment could always ratify it, and still can —
+  // that path never had a non-author to wait for, and an amendment pays nothing,
+  // which is why it was carved out in the first place.
+  //
+  // NO KARMA FOR VOTING ON YOUR OWN ITEM. The +1 exists to reward the work of
+  // reading someone else's idea and taking a position on it; paying it for a
+  // self-cast would make an author's own ballot a tiny income stream, and the
+  // owner's rule is that a self-vote confers no advantage.
+  // Not even asked for an amendment — the carve-out means there is nothing to
+  // learn, and the read is a query on the vote path.
+  const subjectAuthorId = authorRuleApplies(item.subject_type)
+    ? await db.getBoardItemAuthor(item)
+    : null;
+  const isSelfCast = subjectAuthorId != null && String(subjectAuthorId) === String(voterId);
 
   const inserted = await db.insertBoardVote({
     itemId: id, voterId, direction: v.direction, reasonMd: v.reasonMd, sectionKey: v.sectionKey,
@@ -258,12 +275,15 @@ async function castVote({ itemId, voterId, direction, reasonMd = null, sectionKe
   if (!inserted) {
     // UNIQUE(item_id, voter_id) — the idempotent path. Return what stands.
     const existing = await db.getBoardVote(id, voterId);
-    return { ok: true, vote: existing, fresh: false };
+    return { ok: true, vote: existing, fresh: false, self_cast: isSelfCast };
   }
   // Karma rides the FRESH insert only, and the whole route refused a closed or
   // expired item above, so every paid vote is by construction in-window.
+  if (isSelfCast) {
+    return { ok: true, vote: inserted, fresh: true, karma_delta: 0, self_cast: true };
+  }
   await db.insertVoteKarma({ voterId, itemId: id, delta: VOTE_KARMA_DELTA });
-  return { ok: true, vote: inserted, fresh: true, karma_delta: VOTE_KARMA_DELTA };
+  return { ok: true, vote: inserted, fresh: true, karma_delta: VOTE_KARMA_DELTA, self_cast: false };
 }
 
 // ── close + tally (BV1.R10 of goal 1000069, ADR 0175 §3) ────────────────────
@@ -299,19 +319,128 @@ async function castVote({ itemId, voterId, direction, reasonMd = null, sectionKe
 // `WHERE outcome = 'passed'` shape survives precisely because closing and
 // emitting are separate acts.
 
-// The whole counting rule. Absence is nulled by what this function DOESN'T
-// read: only cast votes exist here.
-function tallyOutcome(votes) {
-  return (votes || []).some((v) => v.direction === 'no') ? 'returned' : 'passed';
+// ── the author's own vote (task 1003273) ────────────────────────────────────
+//
+// THE RULE THE OWNER CHOSE, and the deadlock it replaces. The old line was flat:
+// an author could not vote on their own idea at all. That is defensible on a
+// board of strangers and produced a dead end here — every open item was authored
+// by the one person looking at them, so the Board Room showed nine sittings and
+// no ballot. The rule now: AN AUTHOR MAY VOTE, AND MAY NEVER DECIDE ALONE.
+//
+// "Never decide alone" is enforced in two places, because there are two ways to
+// decide something:
+//   1. by CLOSING it     — shouldCloseAfterVote requires a NON-AUTHOR vote, so
+//      an author's cast never trips the trigger that ends the sitting;
+//   2. by CARRYING it    — the majority tally requires at least one non-author
+//      YES, so a majority made only of the author cannot ratify.
+// An author's vote still counts toward the majority NUMERATOR (it is a real
+// vote — they sit on the board), it just can never be the whole of it.
+//
+// AND AN AUTHOR CAN NEVER MAKE THEIR OWN IDEA WORSE. Their 'no' is excluded from
+// the objection test, so voting on your own idea cannot return it — otherwise the
+// safest thing an author could do would be to stay silent, which is a strange
+// incentive to build into a board.
+// THE AUTHOR RULE IS A FULL_IDEA RULE, and that subject-typing is load-bearing
+// rather than tidy (ADR 0175 §§7/11). An idea's author GAINS from ratification
+// (credits, karma, legitimacy), which is what "never decide alone" guards. An
+// amendment pays nothing, and §7 explicitly blesses the monarchy act: on a
+// one-Archon board the proposer must be able to ratify their own amendment or
+// the whole subject type is dead on arrival — and a special escape for that case
+// is precisely the bootstrap exception §7 forbids. So the carve-out is not an
+// exception to the author rule, it is the author rule's scope.
+//
+// Everything downstream reads the author through this: for an amendment the
+// deciding author is NULL, so the trigger and the tally behave exactly as they
+// did before task 1003273.
+const authorRuleApplies = (subjectType) => subjectType === 'full_idea';
+
+// The author id that the DECIDING rules should see: the real one for a full
+// idea, nobody for an amendment.
+const decidingAuthorId = (subjectType, authorId) =>
+  (authorRuleApplies(subjectType) ? authorId : null);
+
+const isAuthorVote = (v, authorId) =>
+  authorId != null && String(v.voter_id) === String(authorId);
+
+// Votes that can DECIDE: everyone but the subject's author.
+const decidingVotes = (votes, authorId) =>
+  (votes || []).filter((v) => !isAuthorVote(v, authorId));
+
+// Strictly more than half — never >=. On an even board of 4 that is 3, not 2:
+// "more than half" is the honest reading of majority, and a tie is not a
+// majority. Of the resolved MEMBERSHIP, not of the votes cast, so low turnout
+// cannot quietly pass something on two voices out of nine.
+function hasMajority(yesCount, memberCount) {
+  if (!Number.isFinite(memberCount) || memberCount <= 0) return false;
+  return yesCount * 2 > memberCount;
+}
+
+// The whole counting rule. Under the two absence-passes rules, absence is nulled
+// by what this function DOESN'T read: only cast votes exist here. Under
+// `majority` absence is the opposite — it is counted, via the membership
+// denominator — which is exactly what makes silence not assent.
+function tallyOutcome(votes, { constitution = {}, members = null, authorId = null } = {}) {
+  const list = votes || [];
+  if (constitution.pass_rule === 'majority') {
+    const yes = list.filter((v) => v.direction === 'yes');
+    const memberCount = Array.isArray(members) ? members.length : 0;
+    // Both conditions, or it returns: a majority of the membership said yes, AND
+    // at least one voice that was not the author's is among them.
+    const carried = hasMajority(yes.length, memberCount)
+      && yes.some((v) => !isAuthorVote(v, authorId));
+    return carried ? 'passed' : 'returned';
+  }
+  // first_ratifier / consent / anything unknown: one reasoned objection returns
+  // the idea, anything else — including ZERO votes — passes. The author's own
+  // vote is excluded so they cannot return their own idea.
+  return decidingVotes(list, authorId).some((v) => v.direction === 'no') ? 'returned' : 'passed';
+}
+
+// Is this majority sitting already DECIDED, whatever the absent members do? Once
+// the yes votes clear the bar the outcome cannot change (there is no
+// vote-changing in v1), and once enough members have voted the OTHER way that the
+// remaining ones cannot reach the bar, it cannot change either. Closing then is
+// not impatience — it is refusing to hold a sitting whose answer is already
+// fixed, which is the same reason consent closes on full turnout.
+function majorityDecided({ votes, members, authorId }) {
+  const list = votes || [];
+  const memberCount = Array.isArray(members) ? members.length : 0;
+  if (!memberCount) return false; // an empty board decides nothing
+  const yes = list.filter((v) => v.direction === 'yes');
+  // Already carried — but only if a non-author yes is among them, since a
+  // majority that is only the author can still be joined by someone who makes
+  // it legitimate. Closing early there would deny the item its one real voice.
+  if (hasMajority(yes.length, memberCount) && yes.some((v) => !isAuthorVote(v, authorId))) return true;
+  // Already unreachable: even if every member who has not voted votes yes, the
+  // bar cannot be met. A member who voted 'no' cannot vote again (v1).
+  const voted = new Set(list.map((v) => String(v.voter_id)));
+  const notYetVoted = members.filter((m) => !voted.has(String(m.builder_id))).length;
+  return !hasMajority(yes.length + notYetVoted, memberCount);
 }
 
 // Should a just-cast vote close the item now, under the SNAPSHOTTED rule?
-function shouldCloseAfterVote({ constitution, votes, members } = {}) {
+//
+// EVERY RULE NEEDS A NON-AUTHOR VOTE FIRST (task 1003273): an author's cast is
+// recorded but never ends the sitting. Without this an author could close their
+// own item under first_ratifier — the very self-decision the rule forbids.
+function shouldCloseAfterVote({ constitution, votes, members, authorId = null } = {}) {
   const rule = (constitution || {}).pass_rule;
-  if (rule === 'first_ratifier') return (votes || []).length >= 1;
+  const deciding = decidingVotes(votes, authorId);
+  if (rule === 'first_ratifier') return deciding.length >= 1;
+  if (rule === 'majority') {
+    if (!deciding.length) return false; // nobody but the author has spoken
+    if (majorityDecided({ votes, members, authorId })) return true;
+    // Full turnout closes it too, when the constitution says so — the same
+    // courtesy consent gets, and by then every position is on the record.
+    if (!(constitution || {}).close_early_on_full_turnout) return false;
+    if (!members || !members.length) return false;
+    const voters = new Set((votes || []).map((v) => String(v.voter_id)));
+    return members.every((m) => voters.has(String(m.builder_id)));
+  }
   if (rule === 'consent') {
     if (!(constitution || {}).close_early_on_full_turnout) return false;
     if (!members || !members.length) return false; // an empty board has no turnout to complete
+    if (!deciding.length) return false;
     const voters = new Set((votes || []).map((v) => String(v.voter_id)));
     return members.every((m) => voters.has(String(m.builder_id)));
   }
@@ -357,15 +486,46 @@ function passPayload(closed, { authorId, completenessScore, passedAt }) {
 async function closeItem(item, { cause = 'vote' } = {}) {
   if (!item || item.closed_at) return { closed: false, reason: 'already_closed' };
   const votes = await db.getVotesForItem(item.id);
-  const outcome = tallyOutcome(votes);
+  const constitution = item.constitution || {};
 
-  // The payload's reads, ahead of the transaction (reads never ride a tx they
-  // don't need). Only a pass needs them, and only a full_idea can pay.
-  let authorId = null;
+  // THE TALLY'S INPUTS ARE READ HERE, NOT PASSED IN, so the two callers — a
+  // racing vote and the expiry sweep — cannot disagree about what a close means
+  // (the invariant R10 already held for the outcome now has to hold for the
+  // majority denominator too). Both are resolved against the item's SNAPSHOT and
+  // the live rows, uncached, the same ADR 0016 posture as every other read here.
+  //
+  // authorId moved AHEAD of the tally (task 1003273): it used to be fetched only
+  // on a pass, for the payload, but the author rule makes it an INPUT to the
+  // outcome — an author's vote must not return their own idea, and a majority
+  // made only of the author must not carry it.
+  // Read ONLY when a decision actually depends on it. For a full idea the author
+  // is an INPUT to the outcome (their 'no' cannot return their own idea, and a
+  // majority with no other voice cannot carry it), so it must be known before the
+  // tally. For an amendment the carve-out makes it irrelevant to the outcome, so
+  // the read stays where it always was — after the tally, only on a pass, for the
+  // payload and the ratification karma. Same query count as before this task on
+  // the amendment path, one extra on an idea close.
+  let authorId = authorRuleApplies(item.subject_type)
+    ? await db.getBoardItemAuthor(item)
+    : null;
+  // Only `majority` needs the membership denominator; the absence-passes rules
+  // read nothing but the cast votes, so we do not spend the query on them.
+  const members = constitution.pass_rule === 'majority'
+    ? await resolveBoardMembers(constitution)
+    : null;
+  const outcome = tallyOutcome(votes, {
+    constitution, members,
+    // Subject-typed: an amendment's proposer is not held to the author rule (§7).
+    authorId: decidingAuthorId(item.subject_type, authorId),
+  });
+
+  // The payload's remaining reads (reads never ride a tx they don't need). Only a
+  // pass needs them, and only a full_idea can pay.
   let completenessScore = null;
   let credit = null;
   if (outcome === 'passed') {
-    authorId = await db.getBoardItemAuthor(item);
+    // The amendment path's author, deferred to here — see the note above.
+    if (authorId == null) authorId = await db.getBoardItemAuthor(item);
     if (item.subject_type === 'full_idea') {
       completenessScore = await db.getIdeaCompleteness(item.subject_id);
     }
@@ -444,7 +604,12 @@ async function maybeCloseAfterVote(itemId) {
   const constitution = item.constitution || {};
   const votes = await db.getVotesForItem(item.id);
   const members = await resolveBoardMembers(constitution);
-  if (!shouldCloseAfterVote({ constitution, votes, members })) {
+  // task 1003273: the author is an input to the trigger, not just the tally — an
+  // author's cast must never be the vote that ends the sitting.
+  const authorId = authorRuleApplies(item.subject_type)
+    ? await db.getBoardItemAuthor(item)
+    : null;
+  if (!shouldCloseAfterVote({ constitution, votes, members, authorId })) {
     return { closed: false, reason: 'window_still_open' };
   }
   return closeItem(item, { cause: 'vote' });
@@ -787,6 +952,9 @@ async function pendingVotesFor(builderId) {
 
 module.exports = {
   pendingVotesFor,
+  hasMajority,
+  majorityDecided,
+  decidingVotes,
   FULL_IDEA_PASS_BAR,
   ideaPassesBar,
   openWindowForFullIdea,

package/modules/government/config.js

@@ -141,6 +141,13 @@ function sanitizeRole(key, raw) {
 // predicate says which RANK governs; who actually holds that rank stays a DB row,
 // resolved per request by R06's membership resolver. Nothing here names a builder,
 // and a config edit cannot make anyone a board member.
+// WHY window_minutes STAYS null HERE (task 1003273). A clock is only safe under
+// a rule where expiry means RETURN. Under first_ratifier and consent the tally
+// passes on absence, so giving a sitting a deadline would make the expiry sweep
+// ratify items NOBODY READ — paying author karma and the idea credit on them.
+// A project that wants a clock wants `majority` first, and sets both together in
+// its own instance pack; the neutral default must not hand every instance an
+// auto-ratifier.
 const BOARD_DEFAULTS = Object.freeze({
   membership: 'rank:archon',
   pass_rule: 'first_ratifier',
@@ -148,11 +155,25 @@ const BOARD_DEFAULTS = Object.freeze({
   close_early_on_full_turnout: true,
 });
 
-// The pass rules that EXIST, not the ones a project should pick. `consent` is the
-// documented recommendation once a project has a board worth sitting (all Archons,
-// one vote each, consent, a 90-minute window); `first_ratifier` is the day-one
-// default and what an unreadable value falls back to.
-const PASS_RULES = Object.freeze(['first_ratifier', 'consent']);
+// The pass rules that EXIST, not the ones a project should pick. `first_ratifier`
+// is the day-one default and what an unreadable value falls back to.
+//
+// THE THREE ARE NOT A LADDER OF STRICTNESS — they differ in what SILENCE means,
+// which is the axis that actually matters (task 1003273):
+//   • first_ratifier — one affirmative act decides. Silence passes (the tally
+//     only returns on a reasoned objection), so an unvoted item ratifies.
+//   • consent        — the same tally over a sitting; an empty window passes
+//     UNOPPOSED. Silence is assent, deliberately (owner decision 6).
+//   • majority       — strictly more than half of the RESOLVED MEMBERSHIP must
+//     vote yes. Silence is NOT assent: an item that never reaches a majority
+//     RETURNS at expiry. This is the only rule under which not voting is a
+//     meaningful act, and the only one where a clock is safe — see the note on
+//     window_minutes below.
+// Adding `majority` cannot widen the fail-closed fallback: sanitizeBoard still
+// falls back to first_ratifier, and majority is the STRICTER end of this axis
+// anyway (it demands affirmative votes from a majority, where the other two
+// pass on absence).
+const PASS_RULES = Object.freeze(['first_ratifier', 'consent', 'majority']);
 
 // A membership predicate names WHO SITS. The grammar and its parser live in
 // ./membership-predicate — ONE implementation, shared with R06's resolver

package/modules/government/routes/government.js

@@ -540,7 +540,12 @@ module.exports = function buildGovernmentRouter() {
         const status =
           out.reason === 'item_not_found' ? 404 :
           out.reason === 'not_board_member' ? 403 :
-          out.reason === 'anti_self_vote' ? 403 :
+          // 'anti_self_vote' was retired by task 1003273 — an author may cast;
+          // what they cannot do is decide alone, which the close trigger and the
+          // tally enforce rather than the route. The mapping is left OUT rather
+          // than kept "just in case": a reason castVote can no longer return
+          // would be dead code pretending to be a wall.
+
           out.reason === 'item_closed' ? 409 :
           out.reason === 'vote_window_expired' ? 409 :
           400; // bad_direction / yes_carries_nothing / objection_needs_reason / objection_needs_section

package/modules/hall-ui/public/government.js

@@ -89,7 +89,6 @@
     validation_failed: 'Missing or invalid fields.',
     // the vote refusals (R17 over R08's route)
     not_board_member: 'Only members of this item\u2019s board may vote on it \u2014 membership follows the rules that were in force when the window opened.',
-    anti_self_vote: 'You can\u2019t vote on your own idea \u2014 that\u2019s the line that keeps ratification honest.',
     item_closed: 'This sitting has closed \u2014 refreshing.',
     vote_window_expired: 'This sitting\u2019s clock has run out \u2014 the sweep is closing it.',
     objection_needs_reason: 'An objection must say why \u2014 write the reason.',
@@ -519,6 +518,14 @@
     if (board.pass_rule === 'consent') {
       return 'Items pass by <strong>consent</strong>: silence is consent, a single reasoned objection returns the item to its author, and a sitting that ends with no votes at all passes.';
     }
+    // task 1003273. The sentence leads with what silence means, because that is
+    // the axis these three rules actually differ on and the one that surprises
+    // people: under the other two an unvoted item passes, under this one it does not.
+    if (board.pass_rule === 'majority') {
+      return 'Items pass by <strong>majority</strong>: more than half of the board must vote yes \u2014 not just more yes than no. '
+        + 'Silence is <em>not</em> agreement here, so an item that never reaches a majority is returned to its author. '
+        + 'An author may vote on their own idea, but it can never be carried by their vote alone.';
+    }
     return `Pass rule: <code>${escapeHtml(String(board.pass_rule || 'unset'))}</code>.`;
   }
 
@@ -694,9 +701,12 @@
       return rem || 'timed sitting';
     }
     const rule = item.constitution && item.constitution.pass_rule;
-    return rule === 'first_ratifier'
-      ? 'no clock — closes on the first vote'
-      : 'no clock';
+    if (rule === 'first_ratifier') return 'no clock — closes on the first vote';
+    // A clockless majority sitting is worth naming honestly: without a deadline
+    // it waits indefinitely for a majority, which is a real state a project can
+    // configure itself into (task 1003273).
+    if (rule === 'majority') return 'no clock — waits for a majority';
+    return 'no clock';
   }
 
   function ballotHtml(item, viewerId) {
@@ -750,12 +760,22 @@
     if (item.closed_at) return '';
     const mine = item.votes.find((v) => String(v.voter_id) === String(viewerId));
     if (mine) return '';
-    if (item.subject_type === 'full_idea' && item.subject && String(item.subject.author_id) === String(viewerId)) {
-      return `<p class="gov-grid-note">This is your idea \u2014 its author does not vote on it. The board decides; a return comes back to you with its reason.</p>`;
-    }
+    // TASK 1003273: the author gets a REAL ballot. The old branch returned a note
+    // and no form, which is what made the Board Room show nine sittings and no
+    // way to vote on any of them — every one of them was the reader's own. They
+    // may now cast; what they cannot do is decide alone (the close trigger needs
+    // a voice that is not theirs, and a majority made only of them cannot carry).
+    // The note says so instead of refusing, so the limit is visible rather than
+    // discovered by clicking.
+    const isOwnIdea = item.subject_type === 'full_idea'
+      && item.subject && String(item.subject.author_id) === String(viewerId);
     const sections = Object.keys(SECTION_LABELS).map((key) => `
       <label class="gov-perm" style="cursor:pointer"><input type="radio" name="vote-section-${escapeHtml(item.id)}" value="${escapeHtml(key)}"> <span>${escapeHtml(SECTION_LABELS[key])}</span></label>`).join('');
+    const ownNote = isOwnIdea
+      ? `<p class="gov-grid-note">This is your idea. You can vote on it \u2014 your position belongs on the record \u2014 but it can\u2019t be decided by your vote alone, and a vote on your own idea earns no karma.</p>`
+      : '';
     return `<div class="gov-vote" data-item="${escapeHtml(item.id)}">
+      ${ownNote}
       <button type="button" class="gov-btn" data-vote="yes">Vote yes</button>
       <details class="gov-vote__no">
         <summary class="gov-btn gov-btn--ghost">Object\u2026</summary>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.364",
+  "version": "1.19.365",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.364",
+      "version": "1.19.365",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.364",
+  "version": "1.19.365",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -1158,8 +1158,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.362 with no explicit bump. run 32889324497. (task 1002620)
 //   1.19.364 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.363 with no explicit bump. run 32890225073. (task 1002620)
+//   1.19.365 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.364 with no explicit bump. run 32893443215. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.364'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.365'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_board_amendment.mjs

@@ -56,7 +56,7 @@ test('every field is required and every refusal is named — no silent correctio
     [{ ...CONSENT_90, extra: true }, 'unknown_field'],
     [{ ...CONSENT_90, membership: 'everyone' }, 'bad_membership'],
     [{ ...CONSENT_90, membership: undefined }, 'bad_membership'],
-    [{ ...CONSENT_90, pass_rule: 'majority' }, 'bad_pass_rule'],
+    [{ ...CONSENT_90, pass_rule: 'unanimous' }, 'bad_pass_rule'],
     [{ ...CONSENT_90, window_minutes: 0 }, 'bad_window_minutes'],
     [{ ...CONSENT_90, window_minutes: 1.5 }, 'bad_window_minutes'],
     [{ ...CONSENT_90, close_early_on_full_turnout: 'yes' }, 'bad_close_early'],
@@ -68,8 +68,14 @@ test('every field is required and every refusal is named — no silent correctio
   }
   // THE CONTRAST WITH THE SANITIZER, stated as an assertion: the sanitizer
   // silently corrects a bad pass_rule; the proposal validator refuses it.
-  assert.equal(config.sanitizeBoard({ ...CONSENT_90, pass_rule: 'majority' }).pass_rule, 'first_ratifier');
-  assert.equal(validateProposedConstitution({ ...CONSENT_90, pass_rule: 'majority' }).ok, false);
+  assert.equal(config.sanitizeBoard({ ...CONSENT_90, pass_rule: 'unanimous' }).pass_rule, 'first_ratifier');
+  assert.equal(validateProposedConstitution({ ...CONSENT_90, pass_rule: 'unanimous' }).ok, false);
+  // THE PERMISSIVE HALF, asserted on purpose (task 1003273): `majority` is a
+  // REAL rule now, so a proposal naming it must be ACCEPTED. This used to be
+  // this file's canonical invalid value — a later change that quietly dropped
+  // majority back out of PASS_RULES has to fail here, not pass silently.
+  assert.equal(validateProposedConstitution({ ...CONSENT_90, pass_rule: 'majority' }).ok, true);
+  assert.equal(config.sanitizeBoard({ ...CONSENT_90, pass_rule: 'majority' }).pass_rule, 'majority');
 });
 
 // ── propose: files the row and opens the window in the same breath ──────────
@@ -101,7 +107,7 @@ test('an invalid proposal files NOTHING — refused before any write', async ()
     openBoardItem: async () => { throw new Error('must not be reached'); },
     builderHoldsRankActive: async () => true,
   }, async () => {
-    assert.equal((await proposeAmendment({ proposal: { ...CONSENT_90, pass_rule: 'majority' }, proposedBy: '42' })).ok, false);
+    assert.equal((await proposeAmendment({ proposal: { ...CONSENT_90, pass_rule: 'unanimous' }, proposedBy: '42' })).ok, false);
     assert.equal((await proposeAmendment({ proposal: CONSENT_90, proposedBy: null })).reason, 'missing_proposer');
   });
 });
@@ -245,15 +251,38 @@ test('the monarchy act end to end: the sole Archon ratifies their OWN amendment
   }
 });
 
-test('anti-self STILL binds for a full_idea — the carve-out is subject-typed', async () => {
+test('the author rule is still SUBJECT-TYPED — but it now limits deciding, not casting (task 1003273)', async () => {
+  // The old assertion here was that an author's cast on a full_idea is REFUSED
+  // (`anti_self_vote`). The owner replaced that rule on 2026-08-25: an author may
+  // vote, and may never decide alone. What must still differ by subject type is
+  // WHO IS HELD TO IT — an amendment proposer is not (§7's monarchy act, proven
+  // in the test above), an idea's author is.
+  let karmaPaid = 0;
+  let inserted = null;
   await withDb({
     getBoardItemForVote: async () => amendmentItem({ subject_type: 'full_idea', subject_id: '7' }),
     builderHoldsRankActive: async () => true,
     getBoardItemAuthor: async () => '42',
-    insertBoardVote: async () => { throw new Error('must not be reached'); },
+    insertBoardVote: async (args) => { inserted = { id: '1', voter_id: args.voterId, direction: args.direction }; return inserted; },
+    insertVoteKarma: async () => { karmaPaid += 1; },
+    getVotesForItem: async () => (inserted ? [inserted] : []),
+    getActiveBuildersWithRank: async () => [{ builder_id: '42', github_login: 'a', display_name: 'A' }],
+    closeBoardItem: async () => { throw new Error('must not close on the author\'s own vote'); },
   }, async () => {
-    assert.deepEqual(await castVote({ itemId: 21, voterId: '42', direction: 'yes' }),
-      { ok: false, reason: 'anti_self_vote' });
+    // 1. The cast is ACCEPTED — this is the permissive half, and it is the half a
+    //    later "tightening" would silently undo.
+    const cast = await castVote({ itemId: 21, voterId: '42', direction: 'yes' });
+    assert.equal(cast.ok, true, `an author's cast on their own idea must land: ${JSON.stringify(cast)}`);
+    assert.equal(cast.self_cast, true);
+    // 2. It earns NO karma — a self-vote confers no advantage.
+    assert.equal(cast.karma_delta, 0);
+    assert.equal(karmaPaid, 0, 'no karma row is written for a self-cast');
+    // 3. And it does NOT end the sitting: under first_ratifier the trigger needs
+    //    a non-author vote, so the item stays open for a real second voice. The
+    //    closeBoardItem stub above throws if this is ever violated.
+    const still = await maybeCloseAfterVote(21);
+    assert.deepEqual({ closed: still.closed, reason: still.reason },
+      { closed: false, reason: 'window_still_open' });
   });
 });
 

package/tests/government_board_close.mjs

@@ -113,7 +113,12 @@ test('a pass pays the author (+3, idempotent downstream); a return pays nobody',
   await withDb({
     getVotesForItem: async () => [no('42')],
     closeBoardItem: async ({ itemId, outcome }) => ({ ...openItem(), id: String(itemId), closed_at: 't', outcome }),
-    getBoardItemAuthor: async () => { throw new Error('must not be reached — a return pays nobody'); },
+    // task 1003273: the author is now READ before the tally on a full_idea —
+    // their own 'no' must not be able to return their own idea — so this can no
+    // longer assert "never asked". What it still asserts is the thing the test is
+    // about: a return PAYS nobody. Someone who did not vote, so the tally is
+    // unaffected by the author rule.
+    getBoardItemAuthor: async () => '999',
     insertAuthorRatifyKarma: async () => { throw new Error('must not be reached'); },
   }, async () => {
     const out = await closeItem(openItem());
@@ -162,6 +167,10 @@ test('consent with turnout outstanding leaves the window open', async () => {
     getBoardItemForVote: async () => openItem({ constitution: CONSENT }),
     getVotesForItem: async () => [yes('1')],
     getActiveBuildersWithRank: async () => [member(1), member(2)], // 1 of 2 voted
+    // task 1003273: the trigger reads the author too (an author's cast never
+    // closes the sitting). '999' voted on nothing, so consent's turnout maths is
+    // exactly as it was.
+    getBoardItemAuthor: async () => '999',
     closeBoardItem: async () => { throw new Error('must not be reached'); },
   }, async () => {
     assert.deepEqual(await maybeCloseAfterVote(11), { closed: false, reason: 'window_still_open' });
@@ -223,7 +232,9 @@ test('a RETURNED item books nothing and emits nothing — only a pass pays or an
       assert.equal(afterClose, null, 'no in-tx hook on a return — nothing to book');
       return { ...openItem(), closed_at: 't', outcome };
     },
-    getBoardItemAuthor: async () => { throw new Error('must not be reached'); },
+    // Read (the author rule's input) but never PAID and never completeness-read —
+    // the two things this test is actually about. See the note on the return case.
+    getBoardItemAuthor: async () => '999',
     getIdeaCompleteness: async () => { throw new Error('must not be reached'); },
   }, async () => {
     const out = await closeItem(openItem());